TrendLabs Malware Blog
Glossary
TrendWatch
TrendLabs Twitter
WORM_AGOBOT.KV
Overview

Malware type: Worm

Aliases: W32.Spybot.Worm (Symantec), HEUR/Crypted (Avira),

In the wild: No

Destructive: No

Language: English

Platform: Windows NT, 2000, XP

Encrypted: No

Overall risk rating:


Reported infections:

Damage potential:

High

Distribution potential:

High

Description: 

This worm exploits certain vulnerabilities to propagate across networks. It takes advantage of the following Windows vulnerabilities:

  • Remote Procedure Call (RPC) Distributed Component Object Model (DCOM) vulnerability
  • IIS5/WEBDAV Buffer Overflow vulnerability
  • RPC Locator Vulnerability

For more information about these Windows vulnerabilities, please refer to the following Microsoft Web pages:

It attempts to log into systems using a list of user names and passwords. This worm then drops a copy of itself in accessed machines.

This worm steals CD keys of certain game applications. It also has backdoor capabilities and may execute remote commands in the host machine.

It runs on Windows NT, 2000 and XP.

For additional information about this threat, see:
Solution
Technical Details

Description created: Jun. 24, 2004 1:34:56 AM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.